// If cfg.GetCertificate is still nil, i.e. we didn't configure a cert watcher, fallback to a self-signed certificate.
 if cfg.GetCertificate == nil {
 // Note: Using self-signed certificates here should be good enough. It's just important that we
 // encrypt the communication. For example kube-controller-manager also uses a self-signed certificate
 // for the metrics endpoint per default.
 cert, key, err := certutil.GenerateSelfSignedCertKeyWithFixtures("localhost", []net.IP{{127, 0, 0, 1}}, nil, "")
 if err != nil {
 return nil, fmt.Errorf("failed to generate self-signed certificate for metrics server: %w", err)
 }
 keyPair, err := tls.X509KeyPair(cert, key)
 if err != nil {
 return nil, fmt.Errorf("failed to create self-signed key pair for metrics server: %w", err)
 }
 cfg.Certificates = []tls.Certificate{keyPair}